Apple iTunes MPEG4 Parsing Buffer Overflow Vulnerability

Bugtraq ID:	13565
Class:	Boundary Condition Error
CVE:	CVE-2005-1248
Remote:	Yes
Local:	No
Published:	May 09 2005 12:00AM
Updated:	Jul 12 2009 02:06PM
Credit:	Discovery credited to Mark Litchfield of NGS Software.
Vulnerable:	Apple iTunes 4.7.1 Apple iTunes 4.7 Apple iTunes 4.6 Apple iTunes 4.5 Apple iTunes 4.2 .72
Not Vulnerable:	Apple iTunes 4.8

Apple iTunes MPEG4 Parsing Buffer Overflow Vulnerability

Apple iTunes MPEG4 file parsing is prone to a buffer overflow. A specifically malformed MPEG4 file could trigger this overflow, causing a denial of service or execution of arbitrary code.

This vulnerability was addressed in iTunes 4.8; all earlier versions are likely affected.

Apple iTunes MPEG4 Parsing Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Apple iTunes MPEG4 Parsing Buffer Overflow Vulnerability

Solution:
Apple has released iTunes 4.8 to address this vulnerability.


Apple iTunes 4.2 .72

• Apple iTunes 4.8
  http://www.apple.com/itunes/download/

Apple iTunes 4.5

• Apple iTunes 4.8
  http://www.apple.com/itunes/download/

Apple iTunes 4.6

• Apple iTunes 4.8
  http://www.apple.com/itunes/download/

Apple iTunes 4.7

• Apple iTunes 4.8
  http://www.apple.com/itunes/download/

Apple iTunes 4.7.1

• Apple iTunes 4.8
  http://www.apple.com/itunes/download/

Apple iTunes MPEG4 Parsing Buffer Overflow Vulnerability

References:

• iTunes Homepage (Apple)